action property

String? action
getter/setter pair

Can be one of ALLOW, DENY, CUSTOM, DENY_BY_DEFAULT.

When the action is CUSTOM, customProvider must be specified. When the action is ALLOW, only requests matching the policy will be allowed. When the action is DENY, only requests matching the policy will be denied. When the action is DENY_BY_DEFAULT, no http_rules or network_rules can be specified. When a request arrives, the policies are evaluated in the following order: 1. If there is a CUSTOM policy that matches the request, the CUSTOM policy is evaluated using the custom authorization providers and the request is denied if the provider rejects the request. 2. If there are any DENY policies that match the request, the request is denied. 3. If any of the ALLOW policies match the request, the request is allowed. 4. If a DENY_BY_DEFAULT policy is applied to the resource, the request is denied (unless it was explicitly allowed by a CUSTOM or ALLOW policy). 5. Else, the request is allowed by default if no other policies are configured.

Required. Possible string values are:

  • "AUTHZ_ACTION_UNSPECIFIED" : Unspecified action.
  • "ALLOW" : Allow request to pass through to the backend.
  • "DENY" : Deny the request and return a HTTP 404 to the client.
  • "CUSTOM" : Delegate the authorization decision to an external authorization engine.
  • "DENY_BY_DEFAULT" : Establishes a secure-by-default posture by denying any request not explicitly matched by any ALLOW, DENY, or CUSTOM policy. This action serves as a universal fallback: if no other policies match or are configured, the request is denied.

Implementation

core.String? action;